Repository navigation
Security Audit
An optional Jamf-only pass, toggled on the Report Extras step. It appears in the finished report as its own Security Audit section.
Needs a licence once the 72-hour free trial has ended. Without one, the option shows Licensed Only. See Licensing.
The audit reads this Jamf instance's own Compliance Benchmarks audit results — it does not scan devices itself and it does not impose an opinion about which baseline you should be running.
The baselines to audit are detected automatically from the Compliance Benchmarks Extension Attributes configured in the instance. You don't pick them by hand. When you turn on the audit, the app connects to Jamf and tells you what it found:
Detected baseline: CIS Level 2. This will be audited.
If more than one baseline is configured, each one gets a checkbox (all ticked by default), so you can leave some out. At least one has to stay ticked. If none are found, the app warns you that there's nothing to audit.
The detected baselines are remembered for that server, so going Back and Continue doesn't query Jamf again. If you connect to a different server, they're detected again, and any choices left over from the previous server are dropped. If detection fails, coming back to the screen tries again.
Rules enforced by both configuration profiles and scripts are covered.
| CIS Level 1 | CIS Level 2 |
| NIST 800-53r5 (Low) | NIST 800-53r5 (Moderate) |
| NIST 800-53r5 (High) | NIST 800-171 |
| DISA STIG |
The OS Branch picker (Catalina → Golden Gate) is only used to look up human-readable rule titles on GitHub. It does not affect which baselines are audited or how compliance is judged.
GitHub is consulted for two things, both cosmetic:
- Rule titles, so a row reads
Disable Bluetooth Sharingrather thanos_bluetooth_sharing_disable - The full rule-ID manifest for a detected baseline, so rules that currently pass on every device still get a row — otherwise the audit would only ever show rules that have failed somewhere, which reads as a much smaller baseline than it is
If GitHub is unreachable the audit still runs; you just get rule IDs instead of titles.
The Security Audit section starts with an Incomplete results warning, and the progress list shows Security Audit (incomplete), when:
- some device inventory pages couldn't be read, so pass and fail counts may be understated
- some rule titles couldn't be fetched from GitHub, so those rules are shown by ID
- the rule manifest couldn't be fetched from GitHub, so only rules failing on at least one device are listed
A partial audit is never presented as all clear.
- Only Jamf's Compliance Benchmarks feature is supported. Legacy mSCP scan methods are not.
- If no Compliance Benchmarks are configured in the instance, there is nothing to detect and nothing to audit.
- Scheduled reports don't run the audit. See Automated Reports.
The separate Security Compliance report section (under 🔒 Security on the sections step) shows device security settings across the fleet, such as FileVault, Gatekeeper, SIP and XProtect. It doesn't use Compliance Benchmarks. See Report Sections.